Title: [167532] trunk/Source/_javascript_Core
- Revision
- 167532
- Author
- [email protected]
- Date
- 2014-04-18 23:53:46 -0700 (Fri, 18 Apr 2014)
Log Message
REGRESSION(r164205): WebKit crash @StructureIDTable::get.
<https://webkit.org/b/130539>
Reviewed by Geoffrey Garen.
prepareOSREntry() prepares for OSR entry by first copying the local var
values from the baseline frame to a scartch buffer, which is then used
to fill in the locals in their new position in the DFG frame. Unfortunately,
prepareOSREntry() was using the DFG frame's frameRegisterCount as the frame
size of the baseline frame. As a result, some values of locals in the
baseline frame were not saved off, and the DFG frame may get initialized
with random content that happened to be in the uninitialized (and possibly
unallocated) portions of the scratch buffer.
The fix is to use OSREntryData::m_expectedValues.numberOfLocals() as the
number of locals in the baseline frame that we want to copy to the scratch
buffer.
Note: osrEntryThunkGenerator() is expecting the DFG frameRegisterCount
at offset 0 in the scratch buffer. So, we continue to write that value
there, not the baseline frame size.
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (167531 => 167532)
--- trunk/Source/_javascript_Core/ChangeLog 2014-04-19 06:04:56 UTC (rev 167531)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-04-19 06:53:46 UTC (rev 167532)
@@ -1,3 +1,30 @@
+2014-04-18 Mark Lam <[email protected]>
+
+ REGRESSION(r164205): WebKit crash @StructureIDTable::get.
+ <https://webkit.org/b/130539>
+
+ Reviewed by Geoffrey Garen.
+
+ prepareOSREntry() prepares for OSR entry by first copying the local var
+ values from the baseline frame to a scartch buffer, which is then used
+ to fill in the locals in their new position in the DFG frame. Unfortunately,
+ prepareOSREntry() was using the DFG frame's frameRegisterCount as the frame
+ size of the baseline frame. As a result, some values of locals in the
+ baseline frame were not saved off, and the DFG frame may get initialized
+ with random content that happened to be in the uninitialized (and possibly
+ unallocated) portions of the scratch buffer.
+
+ The fix is to use OSREntryData::m_expectedValues.numberOfLocals() as the
+ number of locals in the baseline frame that we want to copy to the scratch
+ buffer.
+
+ Note: osrEntryThunkGenerator() is expecting the DFG frameRegisterCount
+ at offset 0 in the scratch buffer. So, we continue to write that value
+ there, not the baseline frame size.
+
+ * dfg/DFGOSREntry.cpp:
+ (JSC::DFG::prepareOSREntry):
+
2014-04-18 Timothy Hatcher <[email protected]>
Web Inspector: Move InspectorProfilerAgent to _javascript_Core
Modified: trunk/Source/_javascript_Core/dfg/DFGOSREntry.cpp (167531 => 167532)
--- trunk/Source/_javascript_Core/dfg/DFGOSREntry.cpp 2014-04-19 06:04:56 UTC (rev 167531)
+++ trunk/Source/_javascript_Core/dfg/DFGOSREntry.cpp 2014-04-19 06:53:46 UTC (rev 167532)
@@ -205,9 +205,11 @@
// 3) Set up the data in the scratch buffer and perform data format conversions.
unsigned frameSize = jitCode->common.frameRegisterCount;
+ unsigned baselineFrameSize = entry->m_expectedValues.numberOfLocals();
+ unsigned maxFrameSize = std::max(frameSize, baselineFrameSize);
+
+ Register* scratch = bitwise_cast<Register*>(vm->scratchBufferForSize(sizeof(Register) * (2 + JSStack::CallFrameHeaderSize + maxFrameSize))->dataBuffer());
- Register* scratch = bitwise_cast<Register*>(vm->scratchBufferForSize(sizeof(Register) * (2 + JSStack::CallFrameHeaderSize + frameSize))->dataBuffer());
-
*bitwise_cast<size_t*>(scratch + 0) = frameSize;
void* targetPC = codeBlock->jitCode()->executableAddressAtOffset(entry->m_machineCodeOffset);
@@ -218,7 +220,7 @@
Register* pivot = scratch + 2 + JSStack::CallFrameHeaderSize;
- for (int index = -JSStack::CallFrameHeaderSize; index < static_cast<int>(frameSize); ++index) {
+ for (int index = -JSStack::CallFrameHeaderSize; index < static_cast<int>(baselineFrameSize); ++index) {
VirtualRegister reg(-1 - index);
if (reg.isLocal()) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
